Date: Thu, 3 Sep 2015 21:02:50 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com Cc: ISC Security Officer <security-officer@....org> Subject: Re: Two new vulnerabilities in BIND: CVE-2015-5722 and CVE-2015-5986 are now public On 09/02/2015 10:52 PM, ISC Security Officer wrote: > Please be advised that ISC publicly announced two critical > vulnerabilities in BIND: > > + CVE-2015-5722 is a denial-of-service vector which can be > exploited remotely against a BIND server that is performing > validation on DNSSEC-signed records. All versions of BIND since > 9.0.0 are vulnerable. > https://kb.isc.org/article/AA-01287 Your patch had quite good obfuscation, and it took me a while to see where the actual fix was. Was this deliberate? But anyway, we can confirm it's exploitable over the network. Nice analysis, I would not have immediately seen that if I only had Hanno's reproducer. For validating recursors, it's actually quite a bit worse than CVE-2015-5477 because CVE-2015-5722 does not require a completely crafted query, just an attacker-controlled QNAME (which can be in the in-addr.arpa or ip6.arpa tree) is sufficient. So attacks could be reflected through basically anything. > + CVE-2015-5986 is a denial-of-service vector which can be used > against a BIND server that is performing recursion and (under > limited conditions) an authoritative-only nameserver. > Versions of BIND since 9.9.7 and 9.10.2 are vulnerable. > https://kb.isc.org/article/AA-01291 This can't be reflected as easily, only through applications that use the affected record type. -- Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.